@agent-cards/sdk 0.23.18 → 0.23.20

package/dist/hipay.generated.d.ts

@@ -0,0 +1,56 @@
+declare var HIPAY_PSP: string;
+declare var HIPAY_CAPABILITY: string;
+declare var HIPAY_OPERATION: string;
+declare var HIPAY_VAULT_HOSTS: Readonly<{
+    "secure2-vault.hipay-tpp.com": "production";
+    "stage-secure2-vault.hipay-tpp.com": "sandbox";
+}>;
+declare var HIPAY_TOKEN_URLS: Readonly<{
+    production: "https://secure2-vault.hipay-tpp.com/rest/v2/token";
+    sandbox: "https://stage-secure2-vault.hipay-tpp.com/rest/v2/token";
+}>;
+declare var HIPAY_UPDATE_PATH: string;
+declare var HIPAY_REFUSAL_CODES: readonly string[];
+declare function hipayTokenEnvironment(url: any): "production" | "sandbox" | null;
+declare function isHipayTokenUrl(url: any): boolean;
+declare function hipayBodyVerdict(body: any): Readonly<{
+    verdict: "refuse";
+    code: any;
+}> | Readonly<{
+    verdict: "card";
+}>;
+declare function hipayNumberOnlyRequest(url: any, method: any, body: any): boolean;
+declare function hipayUsernameEnvironment(username: any): "production" | "sandbox" | null;
+declare function hipayUsername(headers: any): string | null;
+declare function hipayRequestRefusal(request: any): any;
+declare function isPreparedHipayRequest(url: any, method: any, body: any, environment: any, headers: any): boolean;
+declare function hipayPinOriginUsable(origin: any): boolean;
+declare var HIPAY_MERCHANT_PINS: readonly never[];
+declare function hipayOriginPin(merchantOrigin: any, pins?: readonly never[]): null;
+declare function hipayPreparationRefusal(environment: any, merchantOrigin: any, pins?: readonly never[]): "unsupported_environment" | "hipay_merchant_unreviewed" | null;
+declare function hipayMerchantPin(merchantOrigin: any, username: any, pins?: readonly never[]): null;
+declare function hipayMerchantRefusal(environment: any, merchantOrigin: any, username: any, pins?: readonly never[]): "hipay_headers_refused" | "unsupported_environment" | "hipay_merchant_unreviewed" | null;
+declare function hipayRefusalMessage(code: any): any;
+declare function injectHipayCard(body: any, card: any): {
+    body: string;
+    where: string[];
+};
+declare function isHipayDeviceRequest(templateBody: any, deviceBody: any): boolean;
+declare function hipayRefusalCode(text: any): string | null;
+declare function hipayAnswerOutcome(status: any, text: any, card: any): {
+    outcome: string;
+    reason: string;
+    code?: undefined;
+    body?: undefined;
+} | {
+    outcome: string;
+    code: string;
+    reason?: undefined;
+    body?: undefined;
+} | {
+    outcome: string;
+    body: string;
+    reason?: undefined;
+    code?: undefined;
+};
+export { HIPAY_CAPABILITY, HIPAY_MERCHANT_PINS, HIPAY_OPERATION, HIPAY_PSP, HIPAY_REFUSAL_CODES, HIPAY_TOKEN_URLS, HIPAY_UPDATE_PATH, HIPAY_VAULT_HOSTS, hipayAnswerOutcome, hipayBodyVerdict, hipayMerchantPin, hipayMerchantRefusal, hipayNumberOnlyRequest, hipayOriginPin, hipayPinOriginUsable, hipayPreparationRefusal, hipayRefusalCode, hipayRefusalMessage, hipayRequestRefusal, hipayTokenEnvironment, hipayUsername, hipayUsernameEnvironment, injectHipayCard, isHipayDeviceRequest, isHipayTokenUrl, isPreparedHipayRequest };

package/dist/hipay.generated.js

@@ -0,0 +1,389 @@
+// @ts-nocheck
+// Generated from @agent-cards/payment-core. Do not edit.
+// artifact-sha256: 5773dac14c08b16588c9c36803bed4610e1be8f1cdcf6d38507cee1d35740dfc
+// src/hipay.js
+var HIPAY_PSP = "hipay";
+var HIPAY_CAPABILITY = "hipay_vault_token";
+var HIPAY_OPERATION = "hipay.card_request";
+var HIPAY_VAULT_HOSTS = /* @__PURE__ */ Object.freeze({ "secure2-vault.hipay-tpp.com": "production", "stage-secure2-vault.hipay-tpp.com": "sandbox" });
+var HIPAY_TOKEN_URLS = /* @__PURE__ */ Object.freeze({
+    production: "https://secure2-vault.hipay-tpp.com/rest/v2/token",
+    sandbox: "https://stage-secure2-vault.hipay-tpp.com/rest/v2/token"
+});
+var HIPAY_UPDATE_PATH = "/rest/v2/token/update";
+var HIPAY_REFUSAL_CODES = /* @__PURE__ */ Object.freeze([
+    "hipay_url_refused",
+    "hipay_headers_refused",
+    "hipay_number_only",
+    "hipay_keeps_card",
+    "hipay_body_unsupported"
+]);
+var BODY_LIMIT = 2048;
+var HOSTED_KEYS = /* @__PURE__ */ Object.freeze(["multi_use", "card_expiry_month", "card_expiry_year", "card_number", "card_holder", "cvc"]);
+var HOSTED_KEYS_NO_HOLDER = /* @__PURE__ */ Object.freeze(["multi_use", "card_expiry_month", "card_expiry_year", "card_number", "cvc"]);
+var DIRECT_KEYS = /* @__PURE__ */ Object.freeze(["card_expiry_month", "card_expiry_year", "card_number", "card_holder", "cvc", "multi_use"]);
+var DIRECT_KEYS_NO_HOLDER = /* @__PURE__ */ Object.freeze(["card_expiry_month", "card_expiry_year", "card_number", "cvc", "multi_use"]);
+var CARD_SHAPES = /* @__PURE__ */ Object.freeze([HOSTED_KEYS, HOSTED_KEYS_NO_HOLDER, DIRECT_KEYS, DIRECT_KEYS_NO_HOLDER]);
+var NUMBER_ONLY_KEYS = /* @__PURE__ */ Object.freeze(["multi_use", "card_expiry_month", "card_expiry_year", "card_number"]);
+var CARD_NUMBER = /^[0-9]{12,19}$/;
+var SECURITY_CODE = /^[0-9]{3,4}$/;
+var MONTH = /^(?:0[1-9]|1[0-2])$/;
+var YEAR = /^20[0-9]{2}$/;
+var TEXT_LIMIT = 256;
+var CONTROL = /[\u0000-\u001f\u007f]/;
+var JSON_TYPE = /^application\/json(?:\s*;\s*charset=utf-8)?$/i;
+var BASIC = /^Basic ([A-Za-z0-9+/]{4,512}={0,2})$/;
+var PRODUCTION_USERNAME = /^[0-9]{6,12}\.(?:secure-gateway|api)\.hipay-tpp\.com$/;
+var SANDBOX_USERNAME = /^[0-9]{6,12}\.stage-secure-gateway\.hipay-tpp\.com$/;
+var PASSWORD = /^[\x21-\x7e]{8,128}$/;
+var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var sameKeys = (value, keys) => {
+    const own = Object.keys(value);
+    return own.length === keys.length && own.every((key, at) => key === keys[at]);
+};
+var plainText = (value) => typeof value === "string" && value.length <= TEXT_LIMIT && !CONTROL.test(value) && (value.match(/[0-9]/g) ?? []).length < 12;
+var refuse = (code) => Object.freeze({ verdict: "refuse", code });
+var CARD = /* @__PURE__ */ Object.freeze({ verdict: "card" });
+function hipayTokenEnvironment(url) {
+    if (url === HIPAY_TOKEN_URLS.production)
+        return "production";
+    if (url === HIPAY_TOKEN_URLS.sandbox)
+        return "sandbox";
+    return null;
+}
+function isHipayTokenUrl(url) {
+    return hipayTokenEnvironment(url) !== null;
+}
+function readBody(body) {
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT)
+        return null;
+    let value;
+    try {
+        value = JSON.parse(body);
+        if (!record(value) || JSON.stringify(value) !== body)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return value;
+}
+function hipayBodyVerdict(body) {
+    const value = readBody(body);
+    if (value === null)
+        return refuse("hipay_body_unsupported");
+    if (sameKeys(value, NUMBER_ONLY_KEYS))
+        return refuse("hipay_number_only");
+    if (!CARD_SHAPES.some((keys) => sameKeys(value, keys)))
+        return refuse("hipay_body_unsupported");
+    if (typeof value.card_number !== "string" || !CARD_NUMBER.test(value.card_number) || typeof value.cvc !== "string" || !SECURITY_CODE.test(value.cvc) || typeof value.card_expiry_month !== "string" || !MONTH.test(value.card_expiry_month) || typeof value.card_expiry_year !== "string" || !YEAR.test(value.card_expiry_year) || "card_holder" in value && !plainText(value.card_holder)) {
+        return refuse("hipay_body_unsupported");
+    }
+    if (value.multi_use === 1)
+        return refuse("hipay_keeps_card");
+    return value.multi_use === 0 ? CARD : refuse("hipay_body_unsupported");
+}
+function hipayNumberOnlyRequest(url, method, body) {
+    if (typeof method !== "string" || method.toUpperCase() !== "POST" || !isHipayTokenUrl(url))
+        return false;
+    if (typeof body !== "string" || body === "" || body.length > BODY_LIMIT)
+        return false;
+    let value;
+    try {
+        value = JSON.parse(body);
+    }
+    catch {
+        return false;
+    }
+    return record(value) && !(typeof value.cvc === "string" && SECURITY_CODE.test(value.cvc));
+}
+function headerValue(headers, name) {
+    const found = Object.keys(headers).filter((key) => key.toLowerCase() === name);
+    return found.length === 1 && typeof headers[found[0]] === "string" ? headers[found[0]] : null;
+}
+function base64Text(input) {
+    if (input.length % 4 !== 0)
+        return null;
+    const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+    const stripped = input.replace(/={1,2}$/, "");
+    if (stripped.includes("="))
+        return null;
+    let out = "";
+    let bits = 0;
+    let value = 0;
+    for (const character of stripped) {
+        const sextet = alphabet.indexOf(character);
+        if (sextet < 0)
+            return null;
+        value = value << 6 | sextet;
+        bits += 6;
+        if (bits >= 8) {
+            bits -= 8;
+            out += String.fromCharCode(value >> bits & 255);
+            value &= (1 << bits) - 1;
+        }
+    }
+    return out;
+}
+function hipayUsernameEnvironment(username) {
+    if (typeof username !== "string")
+        return null;
+    if (PRODUCTION_USERNAME.test(username))
+        return "production";
+    return SANDBOX_USERNAME.test(username) ? "sandbox" : null;
+}
+function hipayUsername(headers) {
+    if (!record(headers))
+        return null;
+    const authorization = headerValue(headers, "authorization");
+    const basic = authorization === null ? null : BASIC.exec(authorization);
+    const text = basic ? base64Text(basic[1]) : null;
+    const colon = text === null ? -1 : text.indexOf(":");
+    if (colon <= 0)
+        return null;
+    const username = text.slice(0, colon);
+    return hipayUsernameEnvironment(username) !== null && PASSWORD.test(text.slice(colon + 1)) ? username : null;
+}
+function hipayRequestRefusal(request) {
+    if (!record(request) || typeof request.method !== "string" || request.method.toUpperCase() !== "POST")
+        return "hipay_url_refused";
+    const environment = hipayTokenEnvironment(request.url);
+    if (environment === null)
+        return "hipay_url_refused";
+    const headers = record(request.headers) ? request.headers : {};
+    const contentType = headerValue(headers, "content-type");
+    const username = hipayUsername(headers);
+    if (contentType === null || !JSON_TYPE.test(contentType.trim()) || username === null || hipayUsernameEnvironment(username) !== environment) {
+        return "hipay_headers_refused";
+    }
+    const verdict = hipayBodyVerdict(request.body);
+    return verdict.verdict === "card" ? null : verdict.code;
+}
+function isPreparedHipayRequest(url, method, body, environment, headers) {
+    return (environment === "production" || environment === "sandbox") && hipayTokenEnvironment(url) === environment && hipayRequestRefusal({ url, method, headers, body }) === null;
+}
+var PIN_ORIGIN = /^https:\/\/([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+)$/;
+var HIPAY_DOMAIN = /(?:^|\.)(?:hipay\.com|hipay-tpp\.com|hipaywallet\.com|hipay-pos-platform\.com|hipaycomprafacil\.com)$/;
+function hipayPinOriginUsable(origin) {
+    const host = typeof origin === "string" ? PIN_ORIGIN.exec(origin) : null;
+    return !!host && !HIPAY_DOMAIN.test(host[1]);
+}
+var HIPAY_MERCHANT_PINS = /* @__PURE__ */ Object.freeze([]);
+var usablePin = (entry) => !!entry && Array.isArray(entry.origins) && Array.isArray(entry.usernames) && entry.origins.length > 0 && entry.usernames.length > 0 && entry.origins.every(hipayPinOriginUsable) && entry.usernames.every((name) => hipayUsernameEnvironment(name) === "production");
+function hipayOriginPin(merchantOrigin, pins = HIPAY_MERCHANT_PINS) {
+    if (typeof merchantOrigin !== "string" || !Array.isArray(pins) || !hipayPinOriginUsable(merchantOrigin))
+        return null;
+    const found = pins.filter((entry) => usablePin(entry) && entry.origins.includes(merchantOrigin));
+    return found.length === 1 ? found[0] : null;
+}
+function hipayPreparationRefusal(environment, merchantOrigin, pins = HIPAY_MERCHANT_PINS) {
+    if (environment === "sandbox")
+        return null;
+    if (environment !== "production")
+        return "unsupported_environment";
+    return hipayOriginPin(merchantOrigin, pins) ? null : "hipay_merchant_unreviewed";
+}
+function hipayMerchantPin(merchantOrigin, username, pins = HIPAY_MERCHANT_PINS) {
+    if (typeof username !== "string" || hipayUsernameEnvironment(username) !== "production")
+        return null;
+    const found = hipayOriginPin(merchantOrigin, pins);
+    return found && found.usernames.includes(username) ? found : null;
+}
+function hipayMerchantRefusal(environment, merchantOrigin, username, pins = HIPAY_MERCHANT_PINS) {
+    if (environment !== "production" && environment !== "sandbox")
+        return "unsupported_environment";
+    if (hipayUsernameEnvironment(username) !== environment)
+        return "hipay_headers_refused";
+    if (environment === "sandbox")
+        return null;
+    return hipayMerchantPin(merchantOrigin, username, pins) ? null : "hipay_merchant_unreviewed";
+}
+var REFUSAL_MESSAGES = /* @__PURE__ */ Object.freeze({
+    hipay_url_refused: "Refusing to pay: this HiPay card request does not go to HiPay's card vault exactly as HiPay's card form sends it. Nothing was sent.",
+    hipay_headers_refused: "Refusing to pay: this HiPay card request does not carry the checkout's own headers. Nothing was sent.",
+    hipay_number_only: "Refusing to pay: this is not the card request of HiPay's card form. Nothing was sent.",
+    hipay_keeps_card: "This payment asks the payment processor to keep your card for later charges, and you cannot agree to that on this page yet.",
+    hipay_body_unsupported: "Refusing to pay: this is not the card request of HiPay's card form. Nothing was sent.",
+    hipay_merchant_unreviewed: "This payment goes to a merchant account Agentcard has not reviewed."
+});
+function hipayRefusalMessage(code) {
+    return Object.prototype.hasOwnProperty.call(REFUSAL_MESSAGES, code) ? REFUSAL_MESSAGES[code] : REFUSAL_MESSAGES.hipay_body_unsupported;
+}
+var WHERE = /* @__PURE__ */ Object.freeze(["card_number", "cvc", "card_expiry_month", "card_expiry_year"]);
+function frameCard(card) {
+    if (!card)
+        return null;
+    const number = String(card.number).replace(/[ -]/g, "");
+    const cvc = String(card.cvc);
+    const month = Number(card.month);
+    const rawYear = Number(card.year);
+    const year = Number.isInteger(rawYear) && rawYear >= 0 && rawYear <= 99 ? 2e3 + rawYear : rawYear;
+    if (!CARD_NUMBER.test(number) || !SECURITY_CODE.test(cvc) || !Number.isInteger(month) || month < 1 || month > 12 || !Number.isInteger(year) || !YEAR.test(String(year)))
+        return null;
+    return { card_number: number, cvc, card_expiry_month: String(month).padStart(2, "0"), card_expiry_year: String(year) };
+}
+function written(body, values) {
+    const value = JSON.parse(body);
+    for (const key of WHERE)
+        value[key] = values[key];
+    return JSON.stringify(value);
+}
+function injectHipayCard(body, card) {
+    const verdict = hipayBodyVerdict(body);
+    if (verdict.verdict !== "card")
+        throw new Error(hipayRefusalMessage(verdict.code));
+    const values = frameCard(card);
+    if (!values)
+        throw new Error("Could not fill the card fields for HiPay. Nothing was sent.");
+    return { body: written(body, values), where: [...WHERE] };
+}
+function isHipayDeviceRequest(templateBody, deviceBody) {
+    if (hipayBodyVerdict(templateBody).verdict !== "card" || hipayBodyVerdict(deviceBody).verdict !== "card")
+        return false;
+    const device = JSON.parse(deviceBody);
+    return written(templateBody, device) === deviceBody && device.card_number !== JSON.parse(templateBody).card_number;
+}
+var ANSWER_LIMIT = 16384;
+var TOKEN = /^[A-Za-z0-9_-]{16,128}$/;
+var LONG_DIGIT_RUN = /[0-9]{13,}/;
+var DIGEST_TOKEN = /^[0-9a-f]{64}$/;
+var PAN = /^([0-9]{6})[xX*]{2,9}([0-9]{4})$/;
+var REQUEST_ID = /^[0-9]{1,11}$/;
+var REQUEST_ID_MAX = 99999999999;
+var CARD_ID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+var WORD = /^[A-Za-z0-9][A-Za-z0-9 _.-]{0,31}$/;
+var COUNTRY = /^[A-Z]{2}$/;
+var VAULT_CODE = /^[0-9]{1,7}$/;
+var ECHO_WINDOW = 7;
+var HIDDEN_FLOOR = 5;
+var SEPARATORS = /[ ._-]/g;
+var WORD_DIGITS = 2;
+var word = (value) => typeof value === "string" && WORD.test(value) && (value.match(/[0-9]/g) ?? []).length <= WORD_DIGITS;
+var ANSWER_KEYS = /* @__PURE__ */ Object.freeze([
+    "token",
+    "request_id",
+    "card_id",
+    "multi_use",
+    "brand",
+    "pan",
+    "card_holder",
+    "card_expiry_month",
+    "card_expiry_year",
+    "issuer",
+    "country",
+    "domestic_network",
+    "card_type",
+    "card_category",
+    "forbidden_issuer_country"
+]);
+function readAnswer(text) {
+    if (typeof text !== "string" || text === "" || text.length > ANSWER_LIMIT)
+        return null;
+    try {
+        const value = JSON.parse(text);
+        return record(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+function vaultCode(answer) {
+    const code = answer ? answer.code : void 0;
+    const text = typeof code === "number" && Number.isInteger(code) && code >= 0 ? String(code) : typeof code === "string" ? code : null;
+    return text !== null && VAULT_CODE.test(text) ? text : null;
+}
+function hipayRefusalCode(text) {
+    const code = vaultCode(readAnswer(text));
+    return code === null ? null : `hipay_${code}`;
+}
+var KEPT = /* @__PURE__ */ Object.freeze({
+    token: (value) => typeof value === "string" && TOKEN.test(value) && (DIGEST_TOKEN.test(value) || !LONG_DIGIT_RUN.test(value)),
+    request_id: (value) => typeof value === "string" && REQUEST_ID.test(value) || Number.isInteger(value) && value >= 0 && value <= REQUEST_ID_MAX,
+    card_id: (value) => typeof value === "string" && CARD_ID.test(value) && !LONG_DIGIT_RUN.test(value),
+    multi_use: (value) => value === 0 || value === false,
+    brand: word,
+    pan: (value) => typeof value === "string" && PAN.test(value),
+    card_holder: plainText,
+    card_expiry_month: (value) => typeof value === "string" && MONTH.test(value),
+    card_expiry_year: (value) => typeof value === "string" && YEAR.test(value),
+    issuer: plainText,
+    country: (value) => typeof value === "string" && COUNTRY.test(value),
+    domestic_network: word,
+    card_type: word,
+    card_category: word,
+    forbidden_issuer_country: (value) => typeof value === "boolean"
+});
+function tokenAnswer(answer) {
+    if (!answer || typeof answer.token !== "string" || typeof answer.pan !== "string")
+        return null;
+    const out = {};
+    for (const key of ANSWER_KEYS) {
+        if (answer[key] === void 0 || answer[key] === null)
+            continue;
+        if (!KEPT[key](answer[key]))
+            return null;
+        out[key] = answer[key];
+    }
+    return out;
+}
+function hipayAnswerOutcome(status, text, card) {
+    if (!Number.isInteger(status))
+        return { outcome: "unknown", reason: "hipay_unconfirmed" };
+    if (status >= 500)
+        return { outcome: "unknown", reason: "server_error" };
+    if (status >= 400 && status < 500)
+        return { outcome: "refused", code: hipayRefusalCode(text) ?? `http_${status}` };
+    if (status !== 200 && status !== 201)
+        return { outcome: "unknown", reason: "hipay_unconfirmed" };
+    const answer = readAnswer(text);
+    if (answer && typeof answer.token !== "string" && vaultCode(answer) !== null)
+        return { outcome: "refused", code: `hipay_${vaultCode(answer)}` };
+    const token = tokenAnswer(answer);
+    if (token === null)
+        return { outcome: "unknown", reason: "hipay_unsafe_response" };
+    if (card) {
+        const sent = frameCard(card);
+        if (!sent)
+            return { outcome: "unknown", reason: "hipay_unsafe_response" };
+        const hidden = sent.card_number.slice(6, -4);
+        const holdsHidden = (key, value) => hidden.length >= HIDDEN_FLOOR && key !== "card_expiry_month" && key !== "card_expiry_year" && String(value).replace(SEPARATORS, "").includes(hidden);
+        if (ANSWER_KEYS.some((key) => key !== "pan" && token[key] !== void 0 && (echoesCard(token[key], sent.card_number) || holdsHidden(key, token[key])))) {
+            return { outcome: "unknown", reason: "hipay_unsafe_response" };
+        }
+        const pan = PAN.exec(token.pan);
+        const brand = brandNetwork(token.brand);
+        const network = cardNetwork(sent.card_number);
+        if (!pan || pan[1] !== sent.card_number.slice(0, 6) || pan[2] !== sent.card_number.slice(-4) || token.card_expiry_month !== void 0 && token.card_expiry_month !== sent.card_expiry_month || token.card_expiry_year !== void 0 && token.card_expiry_year !== sent.card_expiry_year || brand !== null && network !== null && brand !== network) {
+            return { outcome: "unknown", reason: "hipay_token_mismatch" };
+        }
+    }
+    return { outcome: "approved", body: JSON.stringify(token) };
+}
+function echoesCard(value, number) {
+    const digits = String(value).replace(/[^0-9]/g, "");
+    if (digits.length < ECHO_WINDOW)
+        return false;
+    for (let at = 0; at + ECHO_WINDOW <= number.length; at += 1) {
+        if (digits.includes(number.slice(at, at + ECHO_WINDOW)))
+            return true;
+    }
+    return false;
+}
+function cardNetwork(number) {
+    const two = Number(number.slice(0, 2));
+    const four = Number(number.slice(0, 4));
+    if (number.startsWith("4"))
+        return "VISA";
+    if (two >= 51 && two <= 55 || four >= 2221 && four <= 2720)
+        return "MASTERCARD";
+    return two === 34 || two === 37 ? "AMEX" : null;
+}
+function brandNetwork(brand) {
+    const name = typeof brand === "string" ? brand.toUpperCase().replace(/[^A-Z]/g, "") : "";
+    if (name === "VISA")
+        return "VISA";
+    if (name === "MASTERCARD")
+        return "MASTERCARD";
+    return name === "AMERICANEXPRESS" || name === "AMEX" ? "AMEX" : null;
+}
+export { HIPAY_CAPABILITY, HIPAY_MERCHANT_PINS, HIPAY_OPERATION, HIPAY_PSP, HIPAY_REFUSAL_CODES, HIPAY_TOKEN_URLS, HIPAY_UPDATE_PATH, HIPAY_VAULT_HOSTS, hipayAnswerOutcome, hipayBodyVerdict, hipayMerchantPin, hipayMerchantRefusal, hipayNumberOnlyRequest, hipayOriginPin, hipayPinOriginUsable, hipayPreparationRefusal, hipayRefusalCode, hipayRefusalMessage, hipayRequestRefusal, hipayTokenEnvironment, hipayUsername, hipayUsernameEnvironment, injectHipayCard, isHipayDeviceRequest, isHipayTokenUrl, isPreparedHipayRequest };

package/dist/hold.d.ts

@@ -0,0 +1,180 @@
+/** One kind of card request the hold catches although no recogniser pays it. */
+export interface HoldOnlyRule {
+    /** The processor's name, for the record (`bolt`, `placeholder_card`). */
+    psp: string;
+    /** The card request's address. */
+    match: RegExp;
+    /** CDP Fetch url patterns that cover `match`, with an optional resource type. */
+    patterns: Array<{
+        urlPattern: string;
+        resourceType?: string;
+    }>;
+    /** When set, a request to `match` is a card request only if its body passes. */
+    body?: RegExp;
+    kind: 'tokenize' | 'store_card_post';
+    /** The processor's own wait for this request, in ms: the hold cancels before it. */
+    deadlineMs: number;
+    /** Methods that carry the card here. Default POST. */
+    methods?: string[];
+}
+/**
+ * Bolt's embedded card frame (connect.bolt.com credit-card-input): a POST of `{ payload, nonce, public_key }` JSON,
+ * the card boxed to Bolt's key, to `<base>/token` or `<base>/token/cvv`, with a 20 s timeout and retries.
+ */
+export declare const BOLT_HOLD_RULE: HoldOnlyRule;
+/** Each recogniser's own wait for its card request, where it was measured; any other gets HOLD_DEFAULT_DEADLINE_MS. */
+export declare const HOLD_DEADLINES_MS: Readonly<Record<string, number>>;
+export declare const HOLD_DEFAULT_DEADLINE_MS = 30000;
+/** How long before the processor's own wait the hold gives the request up. */
+export declare const HOLD_DEADLINE_MARGIN_MS = 2000;
+/**
+ * Any request whose body carries one of the placeholder card numbers, wherever it goes. It cannot see a card a
+ * processor's frame encrypts first (Bolt, Adyen): those need their own rule. Null without a usable number.
+ */
+export declare function placeholderHoldRule(numbers: readonly string[], deadlineMs?: number): HoldOnlyRule | null;
+/** The hold-only rule a request is a card request under, or null. */
+export declare function matchHoldOnlyRule(request: {
+    url: string;
+    method: string;
+    body: string | null;
+}, rules: readonly HoldOnlyRule[]): HoldOnlyRule | null;
+export interface HoldOptions {
+    /**
+     * The placeholder card numbers the vault gave this page. Any request whose body carries one is held too. Matched
+     * in this process only, never recorded or sent anywhere.
+     */
+    placeholderNumbers?: readonly string[];
+    /** Replaces every recogniser's deadline (tests). */
+    deadlineMs?: number;
+    /** How long before the processor's deadline the hold gives the request up. Default HOLD_DEADLINE_MARGIN_MS. */
+    deadlineMarginMs?: number;
+    /** Called once a card request is held. */
+    onHeld?: (held: HeldCardRequest) => void;
+}
+/** What the hold records of a held request: never its body or headers, which may carry the card. */
+export interface HeldCardRequest {
+    /** The processor, by the recogniser's name (`braintree`), `bolt`, or `placeholder_card`; null when unnamed. */
+    psp: string | null;
+    /** Origin and path only. */
+    endpoint: string;
+    kind: 'tokenize' | 'store_card_post' | 'card_request';
+    /** Whether a release can answer it: a recogniser the SDK pays, never Bolt or a store's own card post. */
+    replayable: boolean;
+    heldAt: number;
+    deadlineMs: number;
+}
+export type HoldState = 'watching' | 'held' | 'released' | 'cancelled' | 'expired' | 'lost' | 'closed';
+export interface HoldReleaseInput {
+    /** The total the person confirmed, an integer in the currency's smallest unit. The approval is created at it. */
+    amount: number;
+    currency: string;
+    /**
+     * The total the page shows now, read by the caller (null when it reads none). Released only when it matches: equal
+     * to `amount` by default, or at most `amount` with `upTo` (an approval at a ceiling). Anything else cancels.
+     */
+    pageTotal: {
+        amount: number;
+        currency: string;
+    } | null;
+    /** `amount` is a ceiling the page total may stay under (a store that prices tax after the card). */
+    upTo?: boolean;
+    /**
+     * Sandbox only: a store's own card post held by the placeholder rule carries the documented test number only, and
+     * is sent on unchanged so the store can answer it (its Review Order). Refused on a live client.
+     */
+    continuePlaceholder?: boolean;
+}
+export interface HoldReleaseOutcome {
+    /**
+     * approved_not_charged: sandbox, the approval was approved and the request never sent on.
+     * authorized: live, the device's answer reached the page. continued: a placeholder post was sent on (sandbox).
+     */
+    outcome: 'approved_not_charged' | 'authorized' | 'continued' | 'declined' | 'expired' | 'failed';
+    authorizationId?: string | null;
+    detail?: string;
+}
+/** The hold of one attachment: `controller.hold`. */
+export interface CardRequestHold {
+    readonly state: HoldState;
+    readonly held: HeldCardRequest | null;
+    /** Card requests failed without being held: a second one, a retry, or one after a decision. */
+    readonly refused: number;
+    /** Resolves with the held request once one is held, or null after `timeoutMs` or once the hold is over. */
+    whenHeld(timeoutMs?: number): Promise<HeldCardRequest | null>;
+    release(input: HoldReleaseInput): Promise<HoldReleaseOutcome>;
+    /** Fail the held request in the page: nothing was created or sent. Every later card request fails at once. */
+    cancel(reason?: string): Promise<void>;
+}
+/** A hold ended without a release: the paused request fails, and every later card request fails at once. */
+export declare class HoldEndedError extends Error {
+    readonly reason: string;
+    constructor(reason: string);
+}
+/** A second card request while one is held: this request alone fails, the held one and the checkout are untouched. */
+export declare class HoldRefusedError extends Error {
+    constructor();
+}
+/** A sandbox release answered: the approval was created and read, and the request was never sent on. */
+export declare class HoldAnsweredError extends Error {
+    readonly outcome: HoldReleaseOutcome;
+    constructor(outcome: HoldReleaseOutcome);
+}
+/** What the transport does with a held request once the person answered. */
+export type HoldDecision = {
+    kind: 'release';
+    amount: number;
+    currency: string;
+    settle: (outcome: HoldReleaseOutcome) => void;
+} | {
+    kind: 'continue';
+    settle: (outcome: HoldReleaseOutcome) => void;
+};
+/**
+ * The hold's state, shared by the transport and the caller. The transport calls `hold` when a card request pauses
+ * and awaits the decision; the caller calls `release` or `cancel`. Not exported from the package: the caller sees
+ * the CardRequestHold face.
+ */
+export declare class HoldGate implements CardRequestHold {
+    private readonly options;
+    private readonly sandbox;
+    private readonly emit;
+    private _state;
+    private _held;
+    private _refused;
+    private timer;
+    private waiters;
+    private pending;
+    readonly rules: HoldOnlyRule[];
+    constructor(options: HoldOptions, sandbox: boolean, emit: (type: string, detail?: unknown) => void);
+    get state(): HoldState;
+    get held(): HeldCardRequest | null;
+    get refused(): number;
+    /** Fetch patterns the hold-only rules need beside the registry's. */
+    patterns(): Array<{
+        urlPattern: string;
+        resourceType?: string;
+    }>;
+    deadlineFor(psp: string | null, rule?: HoldOnlyRule): number;
+    /** A card request that may not be held now (a second one, or one after a decision): counted, and failed by the caller. */
+    refuse(psp: string | null, url: string): boolean;
+    /**
+     * Hold a card request: resolves with the person's decision, or rejects with HoldEndedError when the hold is
+     * cancelled, expires, loses its request or closes. The caller (the transport) answers or fails the request.
+     */
+    hold(input: {
+        psp: string | null;
+        url: string;
+        kind: HeldCardRequest['kind'];
+        replayable: boolean;
+        rule?: HoldOnlyRule;
+    }): Promise<HoldDecision>;
+    /** The page gave up the held request, or its frame went away: nothing was sent. */
+    lost(): void;
+    /** The attachment ended. */
+    close(): void;
+    private end;
+    whenHeld(timeoutMs?: number): Promise<HeldCardRequest | null>;
+    cancel(reason?: string): Promise<void>;
+    release(input: HoldReleaseInput): Promise<HoldReleaseOutcome>;
+    private decide;
+}